CVE-2025-12180
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.4.3. The plugin stores arbitrary CSS styles submitted via the `qi-blocks/v1/update-styles` REST API endpoint without proper sanitization in the `update_global_styles_callback()` function. An authenticated attacker with Contributor-level access or higher can inject arbitrary CSS, which can be used to hide content, overlay fake UI elements, or exfiltrate sensitive information via CSS injection techniques.
Risk Assessment
An attacker with a Contributor account can inject malicious CSS that can deceive users, hide important information, or exfiltrate data through CSS injection techniques. This may lead to phishing or loss of confidentiality.
Recommendation
Update the Qi Blocks plugin to a version later than 1.4.3. Restrict Contributor permissions and regularly review custom CSS styles.
Other vulnerabilities in Qi Blocks
See all- CVE-2026-10096Medium
The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in versions up to and including 1.4.9. Missing validation on the 'page_id' parameter allows authenticated attackers with author-level access or higher to modify Qi Blocks styles of arbitrary posts, templates, or widgets they do not own, including site-wide surfaces via reserved 'template' and 'widget' values.
- CVE-2025-64383Medium
Stored Cross-Site Scripting (XSS) vulnerability in Qi Blocks (versions up to 1.4.3). Allows an attacker to inject a persistent script that executes in the victim's browser.
Original NVD description (English source)
The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.3. This is due to the plugin storing arbitrary CSS styles submitted via the `qi-blocks/v1/update-styles` REST API endpoint without proper sanitization in the `update_global_styles_callback()` function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary CSS, which can be used to perform actions such as hiding content, overlaying fake UI elements, or exfiltrating sensitive information via CSS injection techniques.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS